From d232d4c3928eae6e86678428a24f57a7f2917970 Mon Sep 17 00:00:00 2001
From: Tonis Tiigi <tonistiigi@gmail.com>
Date: Wed, 7 Jan 2026 20:13:08 -0800
Subject: [PATCH] commands: add stubs for policy commands

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
---
 commands/policy/eval.go        | 76 ++++++++++++++++++++++++++++++++++
 commands/policy/json_schema.go | 22 ++++++++++
 commands/policy/root.go        | 21 ++++++++++
 commands/policy/test.go        | 23 ++++++++++
 commands/root.go               |  2 +
 5 files changed, 144 insertions(+)
 create mode 100644 commands/policy/eval.go
 create mode 100644 commands/policy/json_schema.go
 create mode 100644 commands/policy/root.go
 create mode 100644 commands/policy/test.go

diff --git a/commands/policy/eval.go b/commands/policy/eval.go
new file mode 100644
index 000000000..0b54ede5b
--- /dev/null
+++ b/commands/policy/eval.go
@@ -0,0 +1,76 @@
+package policy
+
+import (
+	"os"
+	"strings"
+
+	"github.com/moby/buildkit/frontend/dockerui"
+	"github.com/moby/buildkit/solver/pb"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+func evalCmd() *cobra.Command {
+	var filename string
+	var printOutput bool
+
+	cmd := &cobra.Command{
+		Use:   "eval [source]",
+		Short: "Evaluate policy for a source",
+		Args:  cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runEval(args, filename, printOutput)
+		},
+	}
+	cmd.Flags().StringVar(&filename, "filename", "", "Policy filename to evaluate")
+	cmd.Flags().BoolVar(&printOutput, "print", false, "Print policy output")
+
+	return cmd
+}
+
+func runEval(args []string, filename string, printOutput bool) error {
+	if len(args) > 0 {
+		if _, err := parseSource(args[0]); err != nil {
+			return err
+		}
+	}
+	_ = filename
+	_ = printOutput
+	return errors.New("not implemented")
+}
+
+func parseSource(input string) (*pb.SourceOp, error) {
+	if strings.HasPrefix(input, "docker-image://") {
+		return &pb.SourceOp{Identifier: input}, nil
+	}
+	if strings.HasPrefix(input, "git://") {
+		_, ok, err := dockerui.DetectGitContext(input, nil)
+		if !ok {
+			return nil, errors.Errorf("invalid git context %s", input)
+		}
+		if err != nil {
+			return nil, err
+		}
+		return &pb.SourceOp{Identifier: input}, nil
+	}
+	if strings.HasPrefix(input, "http://") || strings.HasPrefix(input, "https://") {
+		_, ok, err := dockerui.DetectGitContext(input, nil)
+		if ok {
+			return &pb.SourceOp{
+				Identifier: "git://" + input,
+				Attrs: map[string]string{
+					"git.fullurl": input,
+				},
+			}, nil
+		}
+		if err != nil {
+			return nil, err
+		}
+		return &pb.SourceOp{Identifier: input}, nil
+	}
+	// everything else is treated as a local path
+	if _, err := os.Stat(input); err != nil {
+		return nil, errors.Wrapf(err, "invalid local path %s", input)
+	}
+	return &pb.SourceOp{Identifier: "local://context"}, nil
+}
diff --git a/commands/policy/json_schema.go b/commands/policy/json_schema.go
new file mode 100644
index 000000000..ebfac1e17
--- /dev/null
+++ b/commands/policy/json_schema.go
@@ -0,0 +1,22 @@
+package policy
+
+import (
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+func jsonSchemaCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "json-schema",
+		Short: "Print policy JSON schema",
+		Args:  cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runJSONSchema()
+		},
+	}
+	return cmd
+}
+
+func runJSONSchema() error {
+	return errors.New("not implemented")
+}
diff --git a/commands/policy/root.go b/commands/policy/root.go
new file mode 100644
index 000000000..2f8744e08
--- /dev/null
+++ b/commands/policy/root.go
@@ -0,0 +1,21 @@
+package policy
+
+import (
+	"github.com/spf13/cobra"
+)
+
+// RootCmd creates the policy command tree.
+func RootCmd(rootcmd *cobra.Command) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "policy",
+		Short: "Commands for working with build policies",
+	}
+
+	cmd.AddCommand(
+		jsonSchemaCmd(),
+		evalCmd(),
+		testCmd(),
+	)
+
+	return cmd
+}
diff --git a/commands/policy/test.go b/commands/policy/test.go
new file mode 100644
index 000000000..b099a5a41
--- /dev/null
+++ b/commands/policy/test.go
@@ -0,0 +1,23 @@
+package policy
+
+import (
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+func testCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "test <path>",
+		Short: "Run policy tests",
+		Args:  cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runTest(args[0])
+		},
+	}
+	return cmd
+}
+
+func runTest(path string) error {
+	_ = path
+	return errors.New("not implemented")
+}
diff --git a/commands/root.go b/commands/root.go
index 93815cd92..ae6c5801f 100644
--- a/commands/root.go
+++ b/commands/root.go
@@ -6,6 +6,7 @@ import (
 
 	historycmd "github.com/docker/buildx/commands/history"
 	imagetoolscmd "github.com/docker/buildx/commands/imagetools"
+	policycmd "github.com/docker/buildx/commands/policy"
 	"github.com/docker/buildx/util/cobrautil/completion"
 	"github.com/docker/buildx/util/confutil"
 	"github.com/docker/buildx/util/logutil"
@@ -120,6 +121,7 @@ func addCommands(cmd *cobra.Command, opts *rootOptions, dockerCli command.Cli) {
 		installCmd(dockerCli),
 		uninstallCmd(dockerCli),
 		versionCmd(dockerCli),
+		policycmd.RootCmd(cmd),
 		pruneCmd(dockerCli, opts),
 		duCmd(dockerCli, opts),
 		imagetoolscmd.RootCmd(cmd, dockerCli, imagetoolscmd.RootOptions{Builder: &opts.builder}),